Switching networks are normally designed microelectronically such that each bit of the information to be processed is physically represented by one, and only one, electrical node. A configuration such as this is also referred to as “single-rail” circuit technology. Switching networks such as these are, however, relatively uncertain with regard to so-called differential current profile analysis, which is used by unauthorized third parties when attempting to gain access to secret information. Differential current profile analysis, which is also referred to as differential power analysis—DPA —, is one of the most important methods, for example, for attacking smart cards for security purposes. This involves deliberate attacks on confidential information (passwords or cryptographic keys). For a given program or a given algorithm, smart card current profiles which are measured by means of statistical methods, and/or their charge integrals calculated over one or more clock cycles, are evaluated, in which case—for a large number of program runs—it is possible to draw conclusions about the information to be protected from the correlation between the systematic data variation and the respective charge integral.
In contrast to conventional single-rail circuit technology, in which each bit within a data path or signal path is physically represented by one, and only one, electrical node k, an implementation using dual-rail circuit technology results in each bit being represented by two nodes k and kq, with this bit having a valid logic value when k corresponds to the true logic value b of this bit, and kq corresponds to the negated value bn=not (b).
Thus, when the value b=1 is intended to be transmitted, this is done by means of a “1” in the node k. At the same time, however, the value “0” is transmitted at the node kq, so that, overall, both a “1” and a “0” are thus transmitted. When the value b=0 is to be transmitted, the value “1” is at the same time transmitted at the node kq. A “1” and a “0” are thus transmitted in both cases. Assuming that the nodes k and kq are physically identical, it is now no longer possible to use differential current profile analysis to identify whether a “1” or a “0” is being transmitted as the data item. However, this is true only when a signal change actually takes place for each transmitted data item, that is to say when the information “1” and the information “0” alternate. If a number of identical data items are transmitted successively, the characteristics with regard to the capability for attacks by means of differential current profile analysis deteriorate.
The desired invariance of the charge integrals is now achieved by inserting a so-called precharge state, also referred to just as precharge, between in each case two states with valid logic values (b, bn)=(1, 0) or (0, 1), for which both k and kq are charged to the same electrical potential, that is to say they assume logically invalid values (1, 1) or (0, 0). A state sequence for the precharge state (1, 1) could thus appear as follows:                (1, 1)→(0, 1)→(1, 1)→(1, 0)→(1, 1)→(1, 0)→(1, 1)→(0, 1)→ . . .        
It can be said for any such character sequences that the charge on one, and only one, node is changed from “1” to “0” for each transition from (1, 1)→(b, bn), and that one, and only one, node is changed from “0” to “1” for all (b, bn)→(1, 1), irrespective of the logically valid value b of the status bit in question. An analogous situation applies to state sequences with the precharge state (0, 0).
It follows from this that the charge integrals which correspond to these state sequences are independent of the sequence (b, bn) of the logically valid values, provided that care is taken to ensure that the nodes k and kq have the same electrical capacitances. The current profile of a data path implemented in this way is thus independent of time variations in the data to be processed, and is thus resistant to differential current profile analysis.
Circuit arrangements for producing a dual-rail signal are used, for example, in a data processing apparatus such as that shown in FIG. 1. This shows a data processing apparatus 3 which has an arithmetic and logic unit 2 (ALU). An ALU such as this is provided for linking two input values to one another, for example by carrying out an addition process. Two input values a and b are thus linked to form an output value c. A subtraction process can be carried out by supplying one of the two values that are to be linked in inverted form to the ALU, and by at the same time setting a carry bit at the carry-in input of the ALU. In the example in FIG. 1, the signal not (a) is required instead of the signal a. To do this, the data processing apparatus 3 has preprocessing input circuits 1, which are suitable for producing the function not (a).
The input circuit 1 produces an output signal Z, which is transmitted to the ALU. In other situations, the value “0” or the value “1” is required as the input value for the ALU, so that the input circuit 1 therefore also has to have the capability to provide these two values. The required output functions z of the input circuit 1 are thus:                Z=f(a),        Z=not (f(a)),        Z=0 and        Z=1        
The function f in this case indicates that the input data a may be processed further, for example if the data a is scrambled and is first of all intended to be descrambled in order to allow further processing in the ALU. The control signals S0, S1, which are supplied to the input circuit 1, determine which of these four functions should be implemented.
In addition to the signal paths for the signals a, b, z and c, which are shown by bold lines in FIG. 1, signal paths for signals aq, bq, zq and cq are shown by finer lines. These signal paths, or these signals, are present when this is a data processing apparatus 3 which is suitable for processing dual-rail signals. The complementary signal is still always present in addition to the actual data signal, provided that this is a valid data item. In the precharge state mentioned above, the same signal is carried on both signal lines, that is to say a=aq, b=bq, z=aq and c=cq.
The function which is to be provided by the input circuit 1, in conjunction with the two control bits S0 and S1, is thus:z=not(s1·not(f(a<n:1>)=s0·f(a<n:1>)).
According to the prior art, a function such as this is implemented by a circuit arrangement such as that illustrated in FIG. 2. A data word a<n:1> with a length of n bits is supplied to a first circuit unit 4, which forms the function f(a). This signal is additionally inverted, so that both f(a) and not (f(a)) are available for further processing. f(a) is then linked to the control bit S0 in an AND circuit. The value not(f(a)) is likewise linked to the control bit S1 in an AND circuit. The output values from the two AND gates are linked in an OR circuit in order to form the output value z.
A number of series-connected conventional gates are thus used. Such a circuit arrangement which follows the logical system is relatively complex in terms of the number of transistors that need to be used, particularly when a dual-rail signal is intended to be used rather than a single-rail signal. Furthermore, the processing time in circuit arrangements such as these, which also draw a large amount of current, is comparatively long.
As can be seen from the application illustrated in FIG. 1, a circuit such as this occurs not just once in a data processing apparatus, but must be provided separately for each bit that is to be processed in parallel. The circuit must therefore be included 2×32=64 times for a processor operating with a bus width of 32 bits.